Unauthorized File Access in atompm
Summary
GHSA-v86x-f47q-f7f4: Unauthorized File Access in atompm. Affects atompm versions < 0.8.2. Fixed in 0.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Atompm is an npm package that provides functionality for managing Atom packages. It allows users to download and install packages for the Atom text editor. However, versions prior to 0.8.2 are vulnerable to Unauthorized File Access. This vulnerability arises from the package's failure to properly sanitize relative paths in the URL for file downloads. As a result, attackers can exploit this vulnerability to download arbitrary files from the system.
Vulnerability Detail
The vulnerability in atompm allows attackers to access and download files from the system without proper authorization. By manipulating the URL for file downloads, attackers can bypass security measures and retrieve sensitive files. This can lead to unauthorized access to confidential information, compromise of user data, and potential system compromise. The vulnerability is rated as HIGH severity and has been assigned CWE-200.
How To Fix
Minimum fixed version
0.8.2
This is the first release that contains the fix.
npm install atompm@0.8.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the atompm package prior to version 0.8.2 is vulnerable to Unauthorized File Access. It is crucial to upgrade to the fixed version to mitigate the risk of unauthorized file downloads and potential compromise of sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for atompm →
FAQ
The vulnerability allows attackers to download arbitrary files from the system, potentially leading to unauthorized access to sensitive information and compromise of user data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
There are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the atompm package.
Yes, this vulnerability has been reviewed by GitHub and assigned the identifier GHSA-v86x-f47q-f7f4.
This vulnerability is rated as HIGH severity.
